USN-6538-1: PostgreSQL vulnerabilities
6 December 2023
Several security issues were fixed in PostgreSQL.
Releases
Packages
- postgresql-12 - Object-relational SQL database
- postgresql-14 - Object-relational SQL database
- postgresql-15 - Object-relational SQL database
Details
Jingzhou Fu discovered that PostgreSQL incorrectly handled certain unknown
arguments in aggregate function calls. A remote attacker could possibly use
this issue to obtain sensitive information. (CVE-2023-5868)
Pedro Gallegos discovered that PostgreSQL incorrectly handled modifying
certain SQL array values. A remote attacker could use this issue to obtain
sensitive information, or possibly execute arbitrary code. (CVE-2023-5869)
Hemanth Sandrana and Mahendrakar Srinivasarao discovered that PostgreSQL
allowed the pg_signal_backend role to signal certain superuser processes,
contrary to expectations. (CVE-2023-5870)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 23.10
Ubuntu 23.04
Ubuntu 22.04
Ubuntu 20.04
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart PostgreSQL to
make all the necessary changes.
References
Related notices
- USN-6570-1: postgresql-client-9.5, postgresql-doc-9.5, libpq-dev, libpq5, postgresql-contrib-9.5, libecpg6, postgresql-plperl-9.5, postgresql-pltcl-9.5, postgresql-server-dev-9.5, postgresql-plpython-9.5, postgresql-9.5, libecpg-dev, libpgtypes3, postgresql-plpython3-9.5, libecpg-compat3
- USN-6538-2: libpq-dev, libpq5, postgresql-plperl-10, postgresql-doc-10, libecpg6, postgresql-client-10, postgresql-pltcl-10, postgresql-plpython-10, postgresql-plpython3-10, postgresql-server-dev-10, libecpg-dev, libpgtypes3, postgresql-10, libecpg-compat3